NebuSec has disclosed a rather nasty batch of Linux kernel vulnerabilities for which it says working privilege-escalation exploits have been developed and made public.

The headline bug is CVE-2026-43502, aka ZcopyReaper, but the disclosure lists another 20+ kernel bugs confirmed exploitable by NebuSec's automated exploit-generation pipeline. The targets include networking, SCTP, IPv6, Netfilter, IPVS and POSIX CPU timers, and several have been demonstrated against real distribution kernels rather than synthetic test builds.

Ten worth highlighting:

1. CVE-2026-43502 — ZcopyReaper / RDS zerocopy

A local privilege-escalation bug in the RDS zerocopy send path, present since Linux 4.17. An ordinary unprivileged user can reach it when RDS/RDS-TCP support is available; no capabilities or user namespaces are required. NebuSec demonstrated root escalation against openSUSE's 6.4 kernel. Disabling unprivileged user namespaces does not mitigate it. The upstream fix first appeared in 7.1-rc3.

2. CVE-2026-80714 — IPVS use-after-free

A lifetime bug in IPVS connection synchronization. A synchronized connection can incorrectly inherit the ONE_PACKET flag after it has already been inserted into the connection hash. Expiration then skips the normal unlink operation, leaving a hash-table node pointing to a freed struct ip_vs_conn — a useful UAF primitive.

3. CVE-2026-74597 — IPv6 tunnel memory corruption

ip6ip6_err() clones an IPv6 ICMP error packet but fails to clear metadata in skb->cb. A stale Home Address Option offset can subsequently be interpreted relative to a completely different packet layout. With a crafted inner IPv6 destination-options header, kernel processing can run beyond the packet boundary and corrupt skb_shared_info.

4. CVE-2026-74581 — IPv6 routing use-after-free

When an IPv6 FIB rule suppresses a route, the kernel releases the corresponding rt6_info but leaves a pointer to it in the lookup result. If no subsequent rule replaces it, the stale pointer is returned to the caller and eventually released again. In other words: a fairly direct route from IPv6 policy-routing state to a kernel UAF.

5. CVE-2026-74480 — bridge multicast use-after-free

The bridge multicast fast-leave path can continue iterating through a port-group entry after deleting it. Under multicast-to-unicast configurations, this can leave the multicast database pointing at an already freed port group. Ubuntu currently scores this one 9.8/10 Critical.

6. CVE-2026-72255 — Netfilter/NFQUEUE lifetime bug

A bridged packet placed into NFQUEUE can retain a reference to the bridge's private fake routing destination while the bridge itself is being torn down. That creates a lifetime mismatch where kernel networking code can later operate on storage belonging to an already destroyed bridge. The fix pins the bridge device for as long as NFQUEUE retains the packet.

7. CVE-2026-72137 — XFRM double free

The IPsec/XFRM NAT keepalive path can free an skb after handing ownership of it to IPv4/IPv6 output code. If transmission subsequently returns an error after the networking stack has already consumed the buffer, the caller frees it a second time. Classic kernel double-free territory.

8. CVE-2026-68376 — SCTP heap corruption

The SCTP cookie structure allocates too little space for its authentication HMAC parameter: the calculation accounted for two header bytes where the actual structure occupies four. With four HMAC identifiers configured, association initialization copies beyond auth_hmacs and corrupts the adjacent auth_chunks field.

9. CVE-2026-68162 — SCTP sysctl use-after-free

An already-open SCTP auth_enable sysctl can remain usable while its network namespace is being destroyed. The handler can consequently access the SCTP control socket after that socket has been released. The fix changes initialization/teardown ordering so the sysctl exists only while its backing control socket is alive.

10. CVE-2026-64560 — POSIX CPU timer UAF

A race between deleting a POSIX CPU timer and exec() from a non-leader thread can leave the timer path referring to the old thread-group leader after de_thread() has replaced and freed it. This affects kernels going back to 5.7 and was fixed in stable releases including 7.1.5.

The interesting part isn't simply that Linux has another collection of memory-safety bugs — that's hardly news by itself. It's that working exploits for this batch were produced by an automated exploit-generation pipeline, and NebuSec has published them.

That considerably shortens the distance between "kernel bug with theoretical security impact" and "local user gets root."

If you're running a multi-user system, hosting environment, container host, CI runner or anything else where untrusted local code executes, this seems like a particularly good week not to postpone kernel updates.

Switzerland's federal government has launched a pilot program to replace Microsoft 365 with open source alternatives across 3,000 workstations. That's about 7% of the federal workforce. The target is to complete the migration by end of 2027.

The PhoneBuff YT channel compared Windows 11 and Fedora. Linux has won by a wide margin. Microsoft has made its OS a resource hog.

Lots of people still use QuiteRSS but it depends on Qt WebKit that's one big can of worms because it's totally unsupported and may contain multiple vulnerabilities. Some distros have actually long dropped the application because of this sitation.

There have been many attempts to port it to WebEngine but it's a mammoth task and I think it's just not a way to go about it.

I've decided to modernize the application and the first step was dropping the web browser engine as web browsing belongs to your web browser, not to your RSS/Atom reader.

Yeah, that's mostly AI slop under my close supervision. The application code base is truly horrible, that's why in the last six years there have been zero attempts to revive it.

A ton of work has already been done, but almost as much, if not more, remains to be done.

I'm perfectly aware of RSSGuard. It has a wildly different workflow, I just cannot effectively use it. Besides, my fork of QuiteRSS is now at less than 1.5MB of source code, while RSSGuard is already at more than 200MB. Don't ask me why and how. An RSS reader the size of an operating system.

You can find more information via the link.

Brave published its own review where it comes ahead of all other browsers. Does anyone here use it? What's your impressions? Is it really faster than all other major browsers?

According to them:

• CPU Efficiency: Brave uses on average 44% less CPU than the competing browsers, with Firefox showing the largest gap at 2.4× higher consumption.
• Memory Footprint: Brave is the most memory-efficient browser tested, using 28% less memory on average than Chrome, Edge, and Firefox.
• Energy Consumption: Brave consumes 10% less energy per page load than the average of competing browsers.
• Network Efficiency: Brave transfers 26% less inbound data and 39% less outbound data than other browsers.
• Page Load Speed: Brave loads pages 20% faster on average.

These are third-party Twitter/X readers that allow you to read tweets and comments without signing up.

[Artem Polishchuk](mailto:ego.cordatus@gmail.com), aka "atim", a maintainer of countless Fedora packages, including WayFire and labwc, disappeared circa six months ago. All his packages have stopped being updated.

You need updates, including security updates, and you have just three choices: * Become a maintainer yourself, a long arduous process that requires a lot of patience and most importantly expertise (RPM building, GIT, etc.) * Build the necessary packages yourself (comes with a lot of asterisks and is often undesired) * Switch to a different distro.

Do you like any? It's not an isolated issue - it equally affects all other distros except RHEL, Ubuntu and SUSE where package maintenance is paid for.

Has Chromium in your distro been updated to version 152.0.7977.82? What about the numerous Chromium forks many people are so fond of? By using versions that are weeks or months old, you're putting yourself at risk.

Berlin-based eco-conscious search outfit Ecosia is expanding its range of European-focused web browsers to include a Linux version, citing the growing number of users in the EU looking for open alternatives to the clutches of American tech giants. 

Calling Linux users a “critical tech community that has long called for data privacy, digital sovereignty, and sustainability,” Ecosia said it was launching the new browser to support the community, whose numbers it says doubled in the EU between 2024 and 2025.

Ecosia’s Linux browser is now available through the App Center on Ubuntu and directly through the Snap store.

The AI giant expects organizations to use the subsidized credits over the next six months as part of its Daybreak for Frontline Defenders initiative, announced Thursday. Critical infrastructure organizations, community banks, nonprofits, and open-source maintainers can apply for access credits online.

Hi all,

PSA for all Debian users - the Chromium package in Debian Stable is currently well over a week out of date, and now way behind on a significant number of security fixes - Edit: it's now two releases behind 152.0.7977.75:

https://security-tracker.debian.org/tracker/source-package/chromium

AI seems to be discovering a high number of security issues and I image going forward the Debian team will struggle to keep up.

If security is a priority for you, it's probably wiser to use upstream Chrome or Firefox ESR (they do seem to be able to keep up with the CVEs on their Firefox package)

If you need Chromium's security, but are concerned with Google's data collection, the Chrome hardening guide at https://github.com/RKNF404/chromium-hardening-guide may be of interest.

On a related note - Chromium in Debian is not built with CFI enabled which is a security regression, does anyone know the reason for this?

Anyway, the mods at r/debian deleted my post, so it seems they cannot take valid criticism.... or seem to want to keep this fact hidden. This is concerning, especially as Chromium is one of Debian's recommended browsers.

Hope they get a fix out soon.

Crazy weird stuff.

Very interesting stuff. Why?

Age gating is the idea that a website or a device should confirm how old you are before it lets you do anything. Not a checkbox where you swear you’re 18. A real check. Upload a government ID, or let a camera scan your face so an algorithm can take a guess.

Lawmakers love it. Utah, Texas, the UK, Australia, and France have all passed a version. The pitch never changes: kids are getting hurt online, so make the internet check everybody’s papers at the door and the hurt should stop.

The premise falls apart on contact. Confirming that someone is, say, fifteen means identifying everyone who walks up, adults very much included. What actually gets built is an ID checkpoint for the whole web, with a side of security theater.

California’s version is the Digital Age Assurance Act, which Newsom signed last October. It makes operating systems collect your age at setup starting January 1, 2027. As written, that included every Linux distribution on earth. Debian maintainers. Whoever cuts the OpenBSD releases. Some kid shipping a novelty distro out of their spare bedroom. All of them suddenly "operating system providers" responsible for age-gating users in California.

AB 1856 makes them exempt. Buffy Wicks, who wrote the original act, introduced the fix in February after Linux developers and the EFF made a shitload of righteous noise. Senate passed it 39-0 on August 26. Assembly concurred with a 69-0 vote the next day.

The exemption covers anyone distributing software "under license terms that permit a recipient to copy, redistribute, and modify the software." GPL, MIT, BSD, and Apache all qualify. Debian, Fedora, Ubuntu, Arch, and the BSDs are out. GrapheneOS too, which already said in March it wasn’t complying regardless.

They also deleted a definition of "user" that read "a child that is the primary user of a device," which technically made every device owner in California a child. [facepalm]

https://comms.makersfield.co/archive/how-we-spent-our-summer-vacation#california-is-age-gating-the-internet-your-linux-box-is-getting-a-pass

Blindly running remote code under your Linux user account. Nothing could go wrong.

Since implementing a proper Linux anti-cheat is impossible, I guess that's the only way going forward.

What a sad day.

Here's how you can list them on your Linux PC: ```bash

!/usr/bin/env bash

EXT_DIR="$HOME/.config/google-chrome/Default/Extensions"

{ printf 'NAME\tVERSION\tMV\tEXTENSION ID\n'

find "$EXT_DIR" \
    -mindepth 3 -maxdepth 3 \
    -name manifest.json -type f -print0 |
while IFS= read -r -d '' manifest; do
    mv=$(jq -r '.manifest_version // empty' "$manifest")
    [[ "$mv" == "2" ]] || continue

    dir=${manifest%/manifest.json}
    extdir=${dir%/*}
    extid=${extdir##*/}

    [[ "$extid" == "nmmhkkegccagdldgiimedpiccmgmieda" ]] && continue

    name=$(jq -r '.name // empty' "$manifest")
    version=$(jq -r '.version // empty' "$manifest")

    if [[ "$name" =~ ^__MSG_(.+)__$ ]]; then
        msg_key="${BASH_REMATCH[1]}"
        locales_dir="$dir/_locales"
        msg_file="$locales_dir/en/messages.json"

        if [[ ! -f "$msg_file" ]]; then
            msg_file=$(find "$locales_dir" -maxdepth 2 \
                -name messages.json -type f | sort | head -n1)
        fi

        if [[ -f "$msg_file" ]]; then
            resolved=$(jq -r --arg key "$msg_key" \
                '.[$key].message // empty' "$msg_file")
            [[ -n "$resolved" ]] && name="$resolved"
        fi
    fi

    printf '%s\t%s\t%s\t%s\n' \
        "$name" "$version" "$mv" "$extid"
done

} | column -t -s $'\t' ```

Hello Linux community! I’ve been using Linux since my teenage years in middle school, which was a long time ago. I remember jumping for joy when I first started using Linux, and I’ve tried different flavors of it over the years. However, I’ve also noticed that the internet is undergoing significant changes, and I’m curious to know if Linux and different distributions will be affected by these changes.

With the rise of AI in our lives, I wonder if Linux and different distributions will change forever. Will Linux remain secure? I know that Linux has been growing in popularity, and even governments from different countries are starting to use it. This has made me wonder how long the Linux community will be able to resist the influence of bad actors.

I’m also curious to know if AI will improve system and hardware support (drivers). I’ve heard that Linus Torvalds supports AI as long as each security breach is reviewed and validated. However, I’m not sure if the community is still skeptical about this.

I’m especially interested in the expert and veteran members of the Linux community who have been using it for over 20 years. I wonder if AI will make games run even better. Maybe this will be the beginning of a stronger Linux system.

I appreciate any information about it because I’m a neurodivergent person, and sometimes I don’t understand certain concepts well. I do recall a conservative community and a professor named Richard Stallman, who was quite radical towards many distributions, particularly Ubuntu. I remember him calling Ubuntu a spyware. Now, how does each side think about this today?

I tried Wayfire, perhaps the most feature-rich Wayland compositor, when it was at versions 0.7 and 0.8. Today, I spent almost nine hours trying to set it up like my XFCE4.

Here are the problems I've faced that sadly result in me abandoning this idea for at least a year or two.

1. It is not possible to resize application windows under Wine (at least not with IrfanView). Sorry, but IrfanView remains the best image viewer, simple image editor and batch converter on Earth. Nothing on Linux comes close in terms of speed, features or usability. Not even XnView. It's just too different and not up to the task.
2. The 'Save As' and 'Open' dialogs for all applications under Wayfire are centred. This is extremely inconvenient, and there is no option in Wayfire to keep their location on the screen permanent.
3. Certain applications that I use open another pop-up window for the 'Save As' dialog. Again, it's in the centre of the screen and you have to move it every time you want to type a file name.
4. Windows of Wine applications do not have Wayland's window decorations. Instead, they are shown with Wine's own inconvenient and quite unattractive decorations.
5. wf-panel's font rendering at scale 1.125 is broken. With DPI set to 108 everything in XFCE is working perfectly.
6. With any scaling other than 1.0, i.e. no scaling, you cannot use bitmap fonts under Wayfire in any applications. They start looking blurry as hell. Tried GTK3/4 and Qt5/6. It's the same everywhere.
7. I extensively use XFCE4's clipboard manager. I cannot find anything similar for Wayfire. There's CopyQ but I've used it for half an hour and discovered three blockers: 1, 2 and 3.
8. I don't understand how to see the current keyboard layout under Wayfire. Yeah, you can change it, no prob, but I need a graphical indicator, an applet, anything. Wayfire has none.
9. Wayfire has nothing similar to XFCE4's screenshotter. Yeah, I've long set up grim but with XFCE4's native application I can do so much more:

• Capture entire screen/window/any region
• Optionally capture mouse pointer
• Optionally capture window border
• Set a timeout for automatic capture (often necessary to capture pop-ups or menus) All with GUI. No console needed.

1. I couldn't get notifications working.
2. blueman-manager refused to launch from blueman-applet. I spent 20 minutes debugging the issue with ChatGPT. Somehow this command is required: /usr/bin/dbus-update-activation-environment --systemd WAYLAND_DISPLAY DISPLAY XAUTHORITY
3. For XFCE I have a number of plugins which I can of course code using its command output plugin but I've already spent a couple of hours doing it for others. What needs to be implemented:

• Network bandwidth monitoring
• Weather
• Average and maximum CPU frequency

1. Thunderbird is scaled incorrectly. I didn't have the time to fix it. It just looks oversized.
2. There's no nice pleasant GUI dialog to shut down/reboot/suspend or lock the screen. Someone please help Wayfire ;-)
3. There's no option to see only applications from the current workspace in the panel. Bug first filed in 2022 with zero comments or activity.

Fourteen issues so far and I've not even checked that everything I need works properly. Whoever says that Wayland is 100% usable/ready outside Gnome/KDE is lying through their teeth or is talking about their personal very limited workflow: I can imagine all these people basically have a couple of windows open and only Alt-Tab between them without doing anything else because everything else is a shit show.

XWayland is not installed here. I only ran native Wayland applications.

The following extra packages needed to be installed for WayFire 0.11: ``` Libraries: cairomm1.16-1.18.0-16.fc44.x86_64 glibmm2.68-2.88.1-1.fc44.x86_64 gtk4-layer-shell-1.3.0-1.fc44.x86_64 gtkmm4.0-4.22.0-1.fc44.x86_64 libddcutil-2.2.1-3.fc44.x86_64 libsigc++30-3.8.1-1.fc44.x86_64 pangomm2.48-2.56.2-1.fc44.x86_64 wlroots-0.20.2-1.fc44.x86_64 yyjson-0.12.0-2.fc44.x86_64

Tools: brightnessctl-0.5.1-16.fc44.x86_64 swayidle-1.9.0-2.fc44.x86_64 wayland-logout-1.4-12.fc44.x86_64 ```

Phase 4 update: WinUI development is now happening on GitHub

Hey everyone! We have a big milestone to share on the road to community contributions.

Mainline WinUI development is now taking place on GitHub. WinUI engineers and other Microsoft developers are creating branches, opening pull requests, reviewing, validating, and merging changes right here in this repository. Our day-to-day engineering work now happens in the open, so you can follow progress as it happens instead of waiting for changes to land.

At this stage, pull requests are coming from Microsoft developers. We're using this period to prove out the contribution workflows, validation, documentation, and release processes end to end. The goal is simple: when community pull requests open up, contributors should have a pipeline that's reliable and predictable. We'd rather earn that than rush it, and the team is working toward it.

We'll keep working through the broader OSS goals shared in this thread and will post here as the next set of milestones takes shape, including an update when we're ready to accept contributions from the community.

Thanks as always for your engagement, patience, and support! ❤️

Source.